iPhone (and Mac) 802.1x WPA2-Enterprise fail

Large enterprise with lots of access points (Cisco AIR-AP-1131) using RADIUS authentication going back to Windows (2k3) servers running IAS. WPA2-Enterprise.

Windows devices are able to authenticate fine. Our servers do present an authentication certificate. No certs are required on clients.

When Macs and iPhones try to connect, they are able to successfully authenticate (username/password successfully passed to RADIUS and is accepted), and the client device then asks if we want to accept the server certificate. We do, but we never get an IP address from DHCP.

If we configure a static IP on the client device, it associates but is unable to communicate with anything.

This seems to only happen with Apple devices.

Any ideas? We've tried this with multiple Apple devices running multiple versions of iOS and MacOS.